PR: 2589

[openssl.git] / crypto / dh / dh_gen.c

diff --git a/crypto/dh/dh_gen.c b/crypto/dh/dh_gen.c
index cfd5b118681ed68a2aa8fe9a17c6f46bc9390f7e..d0cecda8d7aa53d3a3045321c8f7bd8b6a38231e 100644 (file)
--- a/crypto/dh/dh_gen.c
+++ b/crypto/dh/dh_gen.c
@@ -61,10 +61,15 @@
  *  - Geoff
  */
 
+#define OPENSSL_FIPSAPI
+
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/dh.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
 
 static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
 
@@ -106,6 +111,20 @@ static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB
        int g,ok= -1;
        BN_CTX *ctx=NULL;
 
+#ifdef OPENSSL_FIPS
+       if(FIPS_selftest_failed())
+               {
+               FIPSerr(FIPS_F_DH_BUILTIN_GENPARAMS,FIPS_R_FIPS_SELFTEST_FAILED);
+               return 0;
+               }
+
+       if (FIPS_module_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
+               {
+               DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);
+               goto err;
+               }
+#endif
+
        ctx=BN_CTX_new();
        if (ctx == NULL) goto err;
        BN_CTX_start(ctx);